Extracted

• • Target

    a877a070ff8a9e1c62b6fb8d21564e79921e5ff5369ede2733fc51cd136cfa6a

  • Size

    1.0MB

  • MD5

    8041d9fab3740fbaa0ff927a0908e073

  • SHA1

    54e32969e2666415cc1c02c45ad70e3f90d7d938

  • SHA256

    a877a070ff8a9e1c62b6fb8d21564e79921e5ff5369ede2733fc51cd136cfa6a

  • SHA512

    ba80f1d90cd879de0866f5cd5834b0c0122c59c41b3062b5ce30ff954d5bb5600e968fda278c0dd5343166c83a779ed4fcfd085b5149de4434398c7c97b774fa

  • SSDEEP

    24576:MymXcVy4JB5oYHDPySOw7yVjwp2eok+RIWGIT6hjpX8T/JSJWe:7mXcVjXoE7yZwvokcuITEjpX8T/Jr

  Score

  10^/10

  mysticpersistencestealerredlinetuxiuinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2